Update Envoy to ad4ddf2 (Nov 13, 2025) (#1446)

- .bazelrc: upstream removed `-runtime-cpu` tags and updated `startup --host_jvm_args=...`
- upstream updated tools/code_format/config.yaml

Signed-off-by: grayson-lafleur-google <[email protected]>

Author: Grayson-LaFleur-Google

.bazelrc

@@ -18,7 +18,7 @@ build:macos --copt -UDEBUG
 # The number 3G is chosen heuristically to both support large VM and small VM with RBE.
 # Startup options cannot be selected via config.
 # TODO: Adding just to test android
-startup --host_jvm_args=-Xmx3g
+startup --host_jvm_args="-DBAZEL_TRACK_SOURCE_DIRECTORIES=1"
 
 common --noenable_bzlmod
 
@@ -77,8 +77,6 @@ build --incompatible_enforce_config_setting_visibility
 test --test_verbose_timeout_warnings
 test --experimental_ui_max_stdouterr_bytes=11712829 #default 1048576
 
-test --test_tag_filters=-runtime-cpu
-
 # Allow tags to influence execution requirements
 common --experimental_allow_tags_propagation
 
@@ -108,6 +106,7 @@ build --@com_googlesource_googleurl//build_config:system_icu=0
 # Common flags for sanitizers
 build:sanitizer --define tcmalloc=disabled
 build:sanitizer --linkopt -ldl
+test:sanitizer --build_tests_only
 
 # Common flags for Clang (shared between all clang variants)
 build:clang-common --action_env=BAZEL_COMPILER=clang
@@ -164,7 +163,7 @@ build:asan-common --config=sanitizer
 build:asan-common --define signal_trace=disabled
 build:asan-common --define ENVOY_CONFIG_ASAN=1
 build:asan-common --build_tag_filters=-no_san
-build:asan-common --test_tag_filters=-no_san,-runtime-cpu
+build:asan-common --test_tag_filters=-no_san
 # The following two lines were manually edited due to #593.                                 # unique
 # Flag undefined was dropped from both the lines to allow CI/ASAN to pass.                  # unique
 build:asan-common --copt -fsanitize=address                                                 # unique
@@ -217,7 +216,7 @@ build:tsan --copt -fsanitize=thread
 build:tsan --linkopt -fsanitize=thread
 build:tsan --copt -DTHREAD_SANITIZER=1
 build:tsan --build_tag_filters=-no_san,-no_tsan
-build:tsan --test_tag_filters=-no_san,-no_tsan,-runtime-cpu
+build:tsan --test_tag_filters=-no_san,-no_tsan
 # Needed due to https://github.com/libevent/libevent/issues/777
 build:tsan --copt -DEVENT__DISABLE_DEBUG_MODE
 # https://github.com/abseil/abseil-cpp/issues/760
@@ -229,7 +228,7 @@ build:tsan --test_env="TSAN_OPTIONS=report_atomic_races=0"
 build:msan --action_env=ENVOY_MSAN=1
 build:msan --config=sanitizer
 build:msan --build_tag_filters=-no_san
-build:msan --test_tag_filters=-no_san,-runtime-cpu
+build:msan --test_tag_filters=-no_san
 build:msan --define ENVOY_CONFIG_MSAN=1
 build:msan --copt -fsanitize=memory
 build:msan --linkopt -fsanitize=memory
@@ -290,10 +289,10 @@ build:coverage --coverage_report_generator=@envoy//tools/coverage:report_generat
 
 build:test-coverage --test_arg="-l trace"
 build:test-coverage --test_arg="--log-path /dev/null"
-build:test-coverage --test_tag_filters=-nocoverage,-fuzz_target,-runtime-cpu
+build:test-coverage --test_tag_filters=-nocoverage,-fuzz_target
 build:fuzz-coverage --config=plain-fuzzer
 build:fuzz-coverage --run_under=@envoy//bazel/coverage:fuzz_coverage_wrapper.sh
-build:fuzz-coverage --test_tag_filters=-nocoverage,-runtime-cpu
+build:fuzz-coverage --test_tag_filters=-nocoverage
 # Existing fuzz tests don't need a full WASM runtime and in generally we don't really want to
 # fuzz dependencies anyways. On the other hand, disabling WASM reduces the build time and
 # resources required to build and run the tests.
@@ -403,7 +402,7 @@ build:compile-time-options --@envoy//source/extensions/filters/http/kill_request
 
 # Docker sandbox
 # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/main/toolchains/rbe_toolchains_config.bzl#L8
-build:docker-sandbox --experimental_docker_image=docker.io/envoyproxy/envoy-build-ubuntu:f4a881a1205e8e6db1a57162faf3df7aed88eae8@sha256:b10346fe2eee41733dbab0e02322c47a538bf3938d093a5daebad9699860b814
+build:docker-sandbox --experimental_docker_image=docker.io/envoyproxy/envoy-build-ubuntu:014410eea358648b3493283e0a4cf6db263bb8e2@sha256:007d4c1814628375b5e6e7e030a2d9ff132f5a0deace98c39d32182c7a72899f
 build:docker-sandbox --spawn_strategy=docker
 build:docker-sandbox --strategy=Javac=docker
 build:docker-sandbox --strategy=Closure=docker
@@ -576,7 +575,7 @@ common:bes-envoy-engflow --bes_timeout=3600s
 common:bes-envoy-engflow --bes_upload_mode=fully_async
 common:bes-envoy-engflow --nolegacy_important_outputs
 common:rbe-envoy-engflow --remote_executor=grpcs://mordenite.cluster.engflow.com
-common:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://gcr.io/envoy-ci/envoy-build@sha256:95d7afdea0f0f8881e88fa5e581db4f50907d0745ac8d90e00357ac1a316abe5
+common:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://gcr.io/envoy-ci/envoy-build@sha256:007d4c1814628375b5e6e7e030a2d9ff132f5a0deace98c39d32182c7a72899f
 common:rbe-envoy-engflow --jobs=200
 common:rbe-envoy-engflow --define=engflow_rbe=true
 

WORKSPACE

@@ -25,6 +25,10 @@ load("@envoy//bazel:repositories.bzl", "envoy_dependencies")
 
 envoy_dependencies()
 
+load("@envoy//bazel:bazel_deps.bzl", "envoy_bazel_dependencies")
+
+envoy_bazel_dependencies()
+
 load("@envoy//bazel:repositories_extra.bzl", "envoy_dependencies_extra")
 
 envoy_dependencies_extra()

bazel/repositories.bzl

@@ -1,7 +1,7 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-ENVOY_COMMIT = "ca1200b8f1cb4d6374542acfe9379c77c83508c2"
-ENVOY_SHA = "c50803c4ac848aff7f1b7da796c91b5be111fb0eb52e5c73286a61239a92e7ab"
+ENVOY_COMMIT = "ad4ddf25a621373b08bef6a3623d365ede89bd9d"
+ENVOY_SHA = "feab0b191867ffc4876618adb552291912a800e0c6d7534a6e4cc953fd9184bf"
 
 HDR_HISTOGRAM_C_VERSION = "0.11.8"  # June 18th, 2025
 HDR_HISTOGRAM_C_SHA = "bb95351a6a8b242dc9be1f28562761a84d4cf0a874ffc90a9b630770a6468e94"

tools/code_format/config.yaml

@@ -335,8 +335,6 @@ paths:
   # Files in these paths can use std::regex
   std_regex:
     include:
-    - contrib/squash/filters/http/source/squash_filter.h
-    - contrib/squash/filters/http/source/squash_filter.cc
     - source/common/common/regex.h
     - source/common/common/regex.cc
     - source/common/common/utility.cc